{"containers": {"cna": {"affected": [{"product": "Advantech WebAccess HMI Designer", "vendor": "n/a", "versions": [{"status": "affected", "version": "Versions 2.1.9.31 and prior"}]}], "descriptions": [{"lang": "en", "value": "Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafted project files that may overflow the heap, which may allow remote code execution, disclosure/modification of information, or cause the application to crash."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "HEAP-BASED BUFFER OVERFLOW CWE-122", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-08-10T16:06:14", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-959/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-958/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-951/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-955/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-950/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2020-16207", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Advantech WebAccess HMI Designer", "version": {"version_data": [{"version_value": "Versions 2.1.9.31 and prior"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafted project files that may overflow the heap, which may allow remote code execution, disclosure/modification of information, or cause the application to crash."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "HEAP-BASED BUFFER OVERFLOW CWE-122"}]}]}, "references": {"reference_data": [{"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02", "refsource": "MISC", "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-20-959/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-959/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-20-958/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-958/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-20-951/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-951/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-20-955/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-955/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-20-950/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-950/"}]}}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2020-16207", "datePublished": "2020-08-06T18:22:34", "dateReserved": "2020-07-31T00:00:00", "dateUpdated": "2020-08-10T16:06:14", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:advantech:webaccess\\/hmi_designer:*:*:*:*:*:*:*:*", "matchCriteriaId": "B10BE31F-862E-4C94-A25A-D8F86CE09C9F", "versionEndIncluding": "2.1.9.31", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafted project files that may overflow the heap, which may allow remote code execution, disclosure/modification of information, or cause the application to crash."}, {"lang": "es", "value": "Advantech WebAccess HMI Designer, versiones 2.1.9.31 y anteriores. M\u00faltiples vulnerabilidades de desbordamiento del b\u00fafer en la regi\u00f3n heap de la memoria pueden ser explotadas al abrir archivos de proyecto especialmente dise\u00f1ados que pueden desbordar la pila, lo que puede permitir una ejecuci\u00f3n de c\u00f3digo remota, divulgaci\u00f3n y modificaci\u00f3n de informaci\u00f3n o causar que la aplicaci\u00f3n se bloquee"}], "id": "CVE-2020-16207", "lastModified": "2023-01-27T20:36:48.257", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-08-06T19:15:13.550", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-950/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-951/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-955/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-958/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-959/"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-122"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}